A disassembly method for embedded processors

Abstract

The present invention discloses a disassembly method for an embedded processor, which belongs to the field of embedded processor disassembly. The method comprises obtaining an instruction type decoding data set document and an instruction format information data set document according to an embedded processor of an ARMv8‑A architecture; constructing an instruction type matching multi-level dictionary according to the instruction type decoding data set document; constructing an instruction format matching multi-level dictionary according to the instruction format information data set document; obtaining an instruction to be tested, and obtaining a disassembly result according to the instruction to be tested by using an instruction type matching multi-level dictionary and an instruction format matching multi-level dictionary. The present invention solves the problem that the existing disassembly tools are not accurate enough in disassembling instructions of embedded processors of the ARMv8‑A architecture.

Description

Technical Field

[0001] The invention belongs to the field of embedded processor disassembly, and in particular relates to a disassembly method for an embedded processor. Background Art

[0002] Disassembly technology, as the name implies, is the reverse process of assembly. It is usually manifested as a technology that converts embedded processor instructions in machine language (such as 0x91efa091) into human-readable assembly representation, which is executed by a disassembler. In recent years, with the rapid development of network technology and modern communication technology, the importance of ARM embedded processors in related fields has attracted much attention. Due to its strong real-time multi-tasking support capability, storage area protection function, scalable microprocessor structure, strong interrupt processing capability, and low power consumption, it has been widely used and developed in military and civilian fields. Opportunities are accompanied by challenges. ARM embedded processors have also become the main target of cyberspace attacks. The attacked processors are out of control, posing a serious threat to the security of the country, enterprises and personal information, causing immeasurable losses.

[0003] In order to safeguard the hardware security of ARM embedded systems, the ARM disassembly tool, as one of the tools required for reverse engineering of embedded processors, will play an important role. The corresponding disassembly technology can improve the security level of the processor by assisting ARM embedded processors in hiding instruction hardware vulnerabilities and other technologies.

[0004] In addition, on the one hand, the more popular ARM disassembly tools include five non-commercial tools angr, BAP, Objdump, Ghidra, and Radare2, and three commercial tools Binary Ninja, Hopper, IDA Pro, and the ARM disassembly framework Capstone. Some of these disassembly tools are expensive and not free or open source, such as IDA Pro. Even if there is a free version, the supported processor models and disassembly functions are limited. Some disassembly tools and frameworks are not yet fully developed, such as Capstone, which causes a large number of embedded processor public instructions to be incorrectly marked as undefined instructions, and the accuracy of disassembly needs to be improved. On the other hand, considering the wide acceptance of the ARM processor architecture by the market; the backward compatibility of the new architecture; the new architecture must have advantages that the original architecture does not have; the new architecture must solve the problems left over from the old architecture and consider the future development trend, ARM has successively proposed different ARM architectures. These ARM architectures have brought challenges to disassembly tools, and the existing disassembly technology can no longer adapt to the latest version of the ARM architecture, such as ARMv8.

[0005] In view of the small number of disassembly tools and frameworks and their applicability to the new ARM architecture, research on ARM embedded processor disassembly technology needs to be enriched. Summary of the invention

[0006] In view of the above-mentioned deficiencies in the prior art, the present invention provides a disassembly method for an embedded processor, which solves the problem that the existing disassembly tools are not accurate enough in disassembling instructions of an embedded processor of the ARMv8-A architecture.

[0007] In order to achieve the above-mentioned invention object, the technical solution adopted by the present invention is: a disassembly method for an embedded processor, comprising the following steps:

[0008] S1. According to the embedded processor of ARMv8-A architecture, obtain the instruction type decoding data set document and the instruction format information data set document;

[0009] S2, decode the dataset document according to the instruction type and build a multi-level dictionary matching the instruction type;

[0010] S3, constructing a multi-level dictionary for instruction format matching according to the instruction format information data set document;

[0011] S4. Obtain the instruction to be tested, and obtain the disassembly result by using the instruction type matching multi-level dictionary and the instruction format matching multi-level dictionary according to the instruction to be tested.

[0012] The beneficial effects of the present invention are as follows: the instruction machine codes of the A64 instruction set, A32 instruction set, and T32 instruction set supported by the embedded processor of the ARMv8-A architecture are taken as disassembly objects, instruction type decoding information and instruction format information are extracted, and the undisclosed instructions in the ISA specification are accurately found by implementing instruction type decoding and instruction format matching, so as to provide ARM disassembly related theory and technical support for the subsequent hidden instruction mining technology of the embedded processor of the ARMv8-A architecture.

[0013] Furthermore, the step S1 is specifically as follows:

[0014] S101. According to an embedded processor of the ARMv8-A architecture, instruction type decoding information of an A64 instruction set, instruction type decoding information of an A32 instruction set, and instruction type decoding information of a T32 instruction set are respectively obtained;

[0015] S102, according to the embedded processor of ARMv8-A architecture, obtaining instruction format information of A64 instruction set, instruction format information of A32 instruction set and instruction format information of T32 instruction set;

[0016] S103, obtaining an instruction type decoding data set document according to the instruction type decoding information of the A64 instruction set, the instruction type decoding information of the A32 instruction set, and the instruction type decoding information of the T32 instruction set;

[0017] S104. Obtain an instruction format information data set document according to the instruction format information of the A64 instruction set, the instruction format information of the A32 instruction set, and the instruction format information of the T32 instruction set.

[0018] The beneficial effect of the above further scheme is: according to the embedded processor of ARMv8-A architecture, an instruction type decoding data set document and an instruction format information data set document are obtained. These two documents count 4914 instruction type information and 4116 instruction format matching information, which will serve as an important instruction data set source for building ARMv8-A disassembly tool.

[0019] Furthermore, the step S2 is specifically as follows:

[0020] S201, decoding the data set document according to the instruction type, and obtaining the number of fields of each instruction type decoding information;

[0021] S202, obtaining the length of each field of each instruction type according to the number of fields of decoding information of each instruction type;

[0022] S203, read the value of each field of each instruction type;

[0023] S204, combining the length of each field of each instruction type and the value of each field of each instruction type according to the rule of full-word matching of regular expressions to obtain a plurality of instruction type information;

[0024] S205, reading the name and index of each instruction type decoding information from the instruction type decoding data set document;

[0025] S206 , obtaining an instruction type matching multi-level dictionary according to each instruction type information and the name and index of each instruction type decoding information.

[0026] The beneficial effects of the above further scheme are: successfully constructing a multi-level dictionary for instruction type matching, which can realize the function of decoding the instruction type of the instruction to be tested, completing the first important function of building an ARMv8-A disassembly tool, and making sufficient preparations for subsequent instruction format matching.

[0027] Furthermore, the step S3 is specifically as follows:

[0028] S301, reading the field value of each instruction format information from the instruction format information data set document;

[0029] S302, calculating the length of each field of each instruction format information according to the instruction format information data set document;

[0030] S303, combining the field value of each instruction format information and the length of each field of each instruction format information using a regular expression to obtain a regular expression of each instruction format information;

[0031] S304, reading the name of each instruction format information from the instruction format information data set document;

[0032] S305 , obtaining an instruction format matching multi-level dictionary according to the regular expressions of each instruction format information and the name of each instruction format information.

[0033] The beneficial effects of the above further scheme are: successfully constructing an instruction format matching multi-level dictionary, realizing the instruction format matching function for the instruction to be tested, and completing the second important function of building the ARMv8-A disassembly tool. The instruction type matching multi-level dictionary and the instruction format matching multi-level dictionary are used successively as an important basis for determining whether the instruction to be tested is a defined instruction or undefined.

[0034] Furthermore, the step S4 is specifically as follows:

[0035] S401, obtaining the instruction to be tested;

[0036] S402, according to the instruction to be tested, use the instruction type to match the multi-level dictionary to obtain a decoding type result;

[0037] S403 , according to the instruction to be tested and the decoding type result, the instruction format is matched with a multi-level dictionary to obtain a disassembly result.

[0038] The beneficial effect of the above further scheme is: on the basis of proposing a disassembly method for embedded processors, by using the disassembly method for massive instructions to be tested to successfully find all undefined instructions in the embedded processor of the ARMv8-A architecture, the rationality, effectiveness and accuracy of the disassembly method are proved.

[0039] Furthermore, the step S403 is specifically as follows:

[0040] S4031, judging whether the instruction to be tested successfully matches the instruction type information in the seven-level dictionary of instruction types according to the decoding type, if so, proceeding to step S4032, otherwise, obtaining a disassembly result, wherein the disassembly result is to define the instruction to be tested as an undefined instruction;

[0041] S4032, judging whether the instruction to be tested has a matching key in the instruction format matching multi-level dictionary according to the decoding type result, if so, proceeding to step S4033, otherwise, obtaining a disassembly result, wherein the disassembly result is an instruction type decoding name of the instruction to be tested with the instruction type decoding result as the instruction type decoding name;

[0042] S4033, use the instruction format matching multi-level dictionary result to perform format matching on the instruction to be tested, and obtain a disassembly result.

[0043] The beneficial effect of the above further scheme is: for the special Unallocated instruction type, UDF instruction type or UNDEFINED instruction type in the instruction type information, it is directly judged as an undefined instruction according to the definition of the instruction type; for the special CONSTRAINED UNPREDICTABLE instruction type or Reserved hintbehaves as NOP instruction type in the instruction type information, which only exists in the instruction type multi-level dictionary, when there is no matching key in the instruction format matching dictionary to match it, they are processed according to their definition to return their corresponding instruction type decoding names.

[0044] Furthermore, there are two cases for the disassembly result in step S4033;

[0045] The first case: the instruction to be tested successfully matches the instruction format information in the instruction format matching multi-level dictionary;

[0046] The second situation: the instruction to be tested does not successfully match the instruction format information in the instruction format matching multi-level dictionary, and the instruction to be tested is defined as an undefined instruction.

[0047] The beneficial effect of the above further scheme is that this disassembly method for embedded processors of ARMv8-A architecture has two results for the instruction to be tested: defined instruction or undefined instruction, so the above scheme also realizes this function and achieves the expected effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0049] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0050] like Figure 1 As shown, in one embodiment of the present invention, a disassembly method for an embedded processor includes the following steps:

[0051] S1. According to the embedded processor of ARMv8-A architecture, obtain the instruction type decoding data set document and the instruction format information data set document;

[0052] S2, decode the dataset document according to the instruction type and build a multi-level dictionary matching the instruction type;

[0053] S3, constructing a multi-level dictionary for instruction format matching based on the instruction format information data set document;

[0054] S4. Obtain the instruction to be tested, and obtain the disassembly result by using the instruction type matching multi-level dictionary and the instruction format matching multi-level dictionary according to the instruction to be tested.

[0055] The step S1 is specifically as follows:

[0056] S101. According to an embedded processor of the ARMv8-A architecture, instruction type decoding information of an A64 instruction set, instruction type decoding information of an A32 instruction set, and instruction type decoding information of a T32 instruction set are respectively obtained;

[0057] S102, according to the embedded processor of ARMv8-A architecture, obtaining instruction format information of A64 instruction set, instruction format information of A32 instruction set and instruction format information of T32 instruction set;

[0058] S103, obtaining an instruction type decoding data set document according to the instruction type decoding information of the A64 instruction set, the instruction type decoding information of the A32 instruction set, and the instruction type decoding information of the T32 instruction set;

[0059] S104. Obtain an instruction format information data set document according to the instruction format information of the A64 instruction set, the instruction format information of the A32 instruction set, and the instruction format information of the T32 instruction set.

[0060] In this embodiment, the instruction type decoding information of three instruction sets (A64, A32 and T32) is extracted from the instruction set of the embedded processor of the ARMv8-A architecture. The instruction type decoding information includes all the instruction type information of the three instruction sets from the top to the last level, a total of 4914 (2424 for the A64 instruction set, 1188 for the A32 instruction set, and 1302 for the T32 instruction set). Each instruction type information includes the name, index, number of fields, name of each field, start of each field, end of each field and each field value information of the instruction type.

[0061] Note: There are a total of three instruction sets available in ARMv8-A, and only one subset of them can be used at any given time, depending on the selected execution state. The A64 instruction set has a fixed instruction length of 32 bits. A32 is functionally similar to A64, with the same 32-bit fixed instruction length, but is very different in encoding. T32 uses variable-length instruction encoding instead of fixed-length instruction encoding, with 32-bit instruction types being the majority and 16-bit instruction types being a very small minority. When extracting T32 instruction type decoding information into the instruction data set document, pay attention to distinguishing between 32-bit instruction types and 16-bit instruction types, and add "H" and "L" to distinguish the start and end of the instruction field of the upper 16 bits and the start and end of the instruction field of the lower 16 bits of the 32-bit instruction type. No distinction is made for 16-bit instruction types.

[0062] The instruction format information of three instruction sets (A64, A32, T32) is extracted from the instruction set of the embedded processor of the ARMv8-A architecture. The instruction format information includes all the instruction encoding format information of the three instruction sets, totaling 4116. Each instruction format information includes the name of the instruction, encoding method, number of fields, name of each field, start of each field, end of each field and value of each field.

[0063] The step S2 is specifically as follows:

[0064] S201, decoding the data set document according to the instruction type, and obtaining the number of fields of each instruction type decoding information;

[0065] S202, obtaining the length of each field of each instruction type according to the number of fields of decoding information of each instruction type;

[0066] S203, read the value of each field of each instruction type;

[0067] S204, combining the length of each field of each instruction type and the value of each field of each instruction type according to the rule of full-word matching of regular expressions to obtain a plurality of instruction type information;

[0068] S205, reading the name and index of each instruction type decoding information from the instruction type decoding data set document;

[0069] S206 , obtaining an instruction type matching multi-level dictionary according to each instruction type information and the name and index of each instruction type decoding information.

[0070] In this embodiment, in step S2, key information is read from the document containing the instruction type decoding data set to design a multi-level instruction type decoding module. The module actually constructs a multi-level dictionary covering all instruction type decoding information, that is, the instruction format matches the multi-level dictionary, and all instruction types are connected in order from the top to the last level according to the index items in the instruction type data set. The purpose of this is to first implement instruction type decoding for each generated instruction to be tested in the process of searching for undisclosed instructions from the instruction space to be tested of the embedded processor of the ARMv8-A architecture, so that the instruction to be tested can be quickly classified, which improves the efficiency of subsequent undefined instruction search and also makes a preliminary judgment for the determination of undefined instructions.

[0071] Read the number of fields of each instruction type decoding information from the instruction type decoding data set document. Then read the values ​​of the start and end of each field of each instruction type, and calculate the length of each field, that is, the formula is "field length = field start - field end + 1". Assuming that the number of fields of this instruction type is n, there are n field lengths. Finally, read the value of each field of each instruction type. Combine the values ​​of all fields and all field lengths according to the rules of regular expression full-word matching. Each 32-bit or 16-bit instruction type composed of 0 and 1 will correspond to an instruction type information represented by a related regular expression, which will be used as the key of the dictionary and all nested sub-dictionaries in the multi-level dictionary.

[0072] It is worth noting that, since the instruction types cover three instruction sets and there are many instruction types, the individual field values ​​corresponding to individual instruction types are not strictly composed of binary numbers 0 or 1. When binary numbers 0 or 1 appear in individual field values, special identifiers also appear, such as "x", should-be-one bit (1), should-be-zero bit (0), field value directly empty, "-" or "!=". Except for the identifier "!=", which means "not" or "not equal to", the meaning of other identifiers is the position of the identifier in the field value, which can be 0 or 1 without restriction. For the three cases of "x", should-be-one bit, and should-be-zero bit (0), each occurrence of these identifiers is represented by the regular expression [0|1] once; for the occurrence of field value directly empty or "-", it is expressed by the regular expression [0|1]{field length}; for the occurrence of "!=", there is a special expression in the regular expression and no special treatment is given.

[0073] The name and index of each instruction type decoding information are read from the instruction type decoding data set document. The dictionary of the instruction type decoding multi-level dictionary designed in the present invention and the values ​​of all nested sub-dictionaries will be a list, the first element of the list is the name of the instruction type, the second element of the list is related to the index of the instruction type, and all instruction type data set index items are judged. If the index item is empty, it means that there is no next level, and the current level is the last level. If it is not empty, it means that there is a next level, and there is a third item of the list element, which represents the decoding information of the next level. The decoding information of the next level is also a dictionary, that is, a nested sub-dictionary. Repeat the previous process and continue to judge the index. There may be sub-dictionaries under the sub-dictionary until the current level index is empty, and the last level of instruction type decoding information is reached. Then the instruction types are connected from the top to the last level in sequence, forming a multi-level dictionary, and the index item is the key to the connection between the upper and lower levels, and it is also the embodiment of "multi-level" in this multi-level dictionary.

[0074] The step S3 is specifically as follows:

[0075] S301, reading the field value of each instruction format information from the instruction format information data set document;

[0076] S302, calculating the length of each field of each instruction format information according to the instruction format information data set document;

[0077] S303, combining the field value of each instruction format information and the length of each field of each instruction format information using a regular expression to obtain a regular expression of each instruction format information;

[0078] S304, reading the name of each instruction format information from the instruction format information data set document;

[0079] S305 , obtaining an instruction format matching multi-level dictionary according to the regular expressions of each instruction format information and the name of each instruction format information.

[0080] In the present embodiment, the step S3 reads key information from the instruction format information data set document to design an instruction format matching module, which designs the instruction encoding format information in A64, A32 and T32 into a multi-level dictionary. The key of the multi-level dictionary is the instruction name, and the value is a list composed of multiple parallel sub-dictionaries, which represent multiple instruction encoding methods corresponding to this instruction. The purpose of designing the instruction format matching module is to realize the efficient and accurate decoding and classification of the embedded processor to be tested instructions of the ARMv8-A architecture in the multi-level instruction type decoding module in step S2, and then match according to the classification results and the instruction format information to obtain a matching result. Through the two links mentioned above, it can be finally determined whether the current instruction to be tested is a defined instruction or an undefined instruction.

[0081] Read the number of fields of each instruction format information from the instruction format information data set document. Then read the beginning and end of each field of each instruction format information, calculate the length of the field, and combine the field value and the field length with a regular expression. Each 32-bit or 16-bit instruction format information composed of a binary combination of 0 or 1 corresponds to an instruction format information represented by a regular expression. For the problem of special identification of individual instruction format information field values, refer to the noteworthy point in the above step S2, which will not be repeated here.

[0082] Read the name of each instruction format information from the instruction format information dataset document. All instruction format names will be used as keys for the multi-level instruction format matching dictionary. The value of each multi-level dictionary is a list consisting of multiple parallel sub-dictionaries. The number of sub-dictionaries in each list depends on how many instruction encodings (encodings) correspond to the current instruction. The key of each sub-dictionary is the serial number of the encoding in the instruction format information dataset, and the value is the instruction format information represented by the regular expression above.

[0083] The step S4 is specifically as follows:

[0084] S401, obtaining the instruction to be tested;

[0085] S402, according to the instruction to be tested, use the instruction type to match the multi-level dictionary to obtain a decoding type result;

[0086] S403 , according to the instruction to be tested and the decoding type result, the instruction format is matched with a multi-level dictionary to obtain a disassembly result.

[0087] The step S403 is specifically as follows:

[0088] S4031, judging whether the instruction to be tested successfully matches the instruction type information in the instruction type matching multi-level dictionary according to the decoding type, if so, proceeding to step S4032, otherwise, obtaining a disassembly result, wherein the disassembly result is to define the instruction to be tested as an undefined instruction;

[0089] S4032, judging whether the instruction to be tested has a matching key in the instruction format matching multi-level dictionary according to the decoding type result, if so, proceeding to step S4033, otherwise, obtaining a disassembly result, wherein the disassembly result is an instruction type decoding name of the instruction to be tested with the instruction type decoding result as the instruction type decoding name;

[0090] S4033, use the instruction format matching multi-level dictionary result to perform format matching on the instruction to be tested, and obtain a disassembly result.

[0091] There are two situations for the disassembly results in step S4033;

[0092] The first case: the instruction to be tested successfully matches the instruction format information in the instruction format matching multi-level dictionary;

[0093] The second situation: the instruction to be tested does not successfully match the instruction format information in the instruction format matching multi-level dictionary, and the instruction to be tested is defined as an undefined instruction.

[0094] In this embodiment, a multi-level instruction type decoding module and an instruction format matching module are designed in steps S2 and S3, which are actually two multi-level dictionaries. The instruction to be tested has already realized instruction type decoding through the multi-level instruction type decoding module, and has realized instruction format matching through the multi-level instruction format matching module. Finally, according to the instruction type and instruction format after the instruction to be tested is matched, the instruction content is specifically parsed.

[0095] The instruction to be tested first implements instruction type decoding, and there are three decoding results. The first is that the decoded instruction type name is Unallocated, UDF, or UNDEFINED. The instruction to be tested is directly marked as an undefined instruction and added to the undefined instruction set. The basis for parsing as an undefined instruction is that Unallocated, UDF, or UNDEFINED represents an unallocated instruction in the instruction space. Such instructions exist in all three instruction sets, not in a single instruction set. There is no encoding allocation function for them in the Armv8 architecture user manual.

[0096] The second is that the instruction type name decoded to the instruction to be tested is CONSTRAINED UNPREDICTABLE or Reserved hint, behaves as NOP. Since there is no corresponding key in the instruction format matching dictionary, the instruction to be tested can be marked with its corresponding instruction type decoding name. The basis for this treatment is that most instructions in the CONSTRAINEDUNPREDICTABLE class are derived from incorrect should-be-one (SBO) and should-be-zero (SBZ) bits. Reserved hint, behaves as NOP is not equivalent to NOP, and the format is different, but Reserved hint, behaves as NOP behaves the same as NOP.

[0097] The rest are all the third cases. The instruction to be tested is decoded to a certain instruction type name (such as the STRH (register) instruction type) through the multi-level instruction type decoding module. Then, it is matched to a certain instruction name (such as the STRH (register) instruction) through the multi-level instruction format matching module. There are multiple instruction encoding methods A1, A2, A3, T1, T2, T3 or others under this matched instruction name. Each encoding method (such as A1) corresponds to one or more instruction format information (such as Offset variant, Post-indexed variant and Pre-indexed variant). Each instruction format information (such as Offset variant) consists of two parts: an opcode and an operand. The opcode indicates the operation to be completed by the instruction, that is, the function of the instruction, and the operand indicates the object involved in the operation, as well as the location where the operation result is stored. The instruction to be tested is matched one by one with the multiple instruction format information under this instruction (such as the STRH (register) instruction). After the matching is completed, there are two results. The first is that the instruction to be tested matches a certain instruction format information of a certain instruction (such as STRH (register) instruction) through the multi-level instruction format matching module, proving that the instruction to be tested is a public instruction and does not record this instruction. The second situation is that the instruction to be tested does not match any instruction encoding format, marking the instruction to be tested as an undefined instruction.

[0098] Whether the instruction to be tested is decoded layer by layer to the last level of instruction type, it can be determined whether it is an undefined instruction, or it is decoded to the specific instruction format information through instruction format matching, and finally it is determined whether it is an undefined instruction, which is a fact. This fact is that there is usually a one-to-one mapping between machine instructions and assembly language instructions. Based on this, it is very meaningful to propose a disassembly method for ARMv8-A embedded processors.

[0099] Based on the proposed disassembly method for embedded processors, the following experiment was conducted. On the host computer, all the instructions to be tested for embedded processors of ARMv8-A architecture were exhaustively searched from 0 to 4294967295, and all undefined instructions were accurately found. The number of undefined instructions was 759323435. Directly storing these undefined instructions takes up too much hard disk space and is not conducive to the later use of these undefined instructions. Therefore, the undefined instructions are stored in the form of recording intervals closed on the left and open on the right. The storage method is to record the [start, end] of countless intervals in the traversal process starting from 0. The start of the interval is the first undefined instruction found in the current section of the instructions to be tested, the end of the interval is a defined instruction, and its previous one is the instruction to be tested. The instructions in the middle are all undefined instructions. In this way, the storage result only takes up a small amount of hard disk space.

[0100] The beneficial effects of the present invention are as follows:

[0101] The present invention proposes a disassembly method for embedded processors. Through the instruction type decoding module and the instruction format matching module, 759323435 undefined instructions of the embedded processor of the ARMv8-A architecture are found. The instruction type decoding can accurately decode all the instructions to be tested layer by layer in strict accordance with the architecture reference manual, and the instruction format matching performs strict instruction format verification and matching on the instructions to be tested again. The undefined instruction space found through two precise comparisons is accurate. Compared with the disassembly framework Capstone, it can effectively reduce the defined instructions from being mistakenly marked as undefined instructions.

Claims

1. A disassembly method for an embedded processor, characterized in that: The following steps are involved: S1. According to the embedded processor of ARMv8-A architecture, obtain the instruction type decoding data set document and the instruction format information data set document; S2, decode the data set document according to the instruction type, and build a multi-level dictionary matching the instruction type; step S2 is specifically as follows: S201, according to the instruction type decoding data set document, obtain the number of fields of each instruction type decoding information; the instruction type decoding information includes instruction type information; the instruction type information includes the name, index, number of fields of the instruction type, the name of each field, the start of each field, the end of each field and the value information of each field; S202, obtaining the length of each field of each instruction type according to the number of fields of decoding information of each instruction type; S203, read the value of each field of each instruction type; S204, combining the length of each field of each instruction type and the value of each field of each instruction type according to the rule of full-word matching of regular expressions to obtain a plurality of instruction type information; S205, reading the name and index of each instruction type decoding information from the instruction type decoding data set document; S206, obtaining an instruction type matching multi-level dictionary according to each instruction type information, the name and index of each instruction type decoding information; S3, constructing a multi-level dictionary for instruction format matching based on the instruction format information data set document; S4, obtaining the instruction to be tested, and according to the instruction to be tested, using the instruction type matching multi-level dictionary and the instruction format matching multi-level dictionary to obtain the disassembly result; step S4 is specifically: S401, obtaining the instruction to be tested; S402, according to the instruction to be tested, use the instruction type to match the multi-level dictionary to obtain a decoding type result; S403, according to the instruction to be tested and the decoding type result, the instruction format is matched with a multi-level dictionary to obtain the disassembly result; step S403 is specifically as follows: S4031, judging whether the instruction to be tested successfully matches the instruction type information in the instruction type matching multi-level dictionary according to the decoding type, if so, proceeding to step S4032, otherwise, obtaining a disassembly result, wherein the disassembly result is to define the instruction to be tested as an undefined instruction; S4032, judging whether the instruction to be tested has a matching key in the instruction format matching multi-level dictionary according to the decoding type result, if so, proceeding to step S4033, otherwise, obtaining a disassembly result, wherein the disassembly result is an instruction type decoding name of the instruction to be tested with the instruction type decoding result as the instruction type decoding name; S4033, use the instruction format matching multi-level dictionary result to perform format matching on the instruction to be tested, and obtain a disassembly result.

2. The disassembly method for an embedded processor according to claim 1, characterized in that: Step S1 is specifically as follows: S101, according to the embedded processor of ARMv8-A architecture, respectively obtain instruction type decoding information of A64 instruction set, instruction type decoding information of A32 instruction set and instruction type decoding information of T32 instruction set; S102, according to the embedded processor of ARMv8-A architecture, obtaining instruction format information of A64 instruction set, instruction format information of A32 instruction set and instruction format information of T32 instruction set; S103, obtaining an instruction type decoding data set document according to the instruction type decoding information of the A64 instruction set, the instruction type decoding information of the A32 instruction set, and the instruction type decoding information of the T32 instruction set; S104. Obtain an instruction format information data set document according to the instruction format information of the A64 instruction set, the instruction format information of the A32 instruction set, and the instruction format information of the T32 instruction set.

3. The disassembly method for an embedded processor according to claim 1, characterized in that: Step S3 is specifically as follows: S301, reading the field value of each instruction format information from the instruction format information data set document; S302, calculating the length of each field of each instruction format information according to the instruction format information data set document; S303, combining the field value of each instruction format information and the length of each field of each instruction format information using a regular expression to obtain a regular expression of each instruction format information; S304, reading the name of each instruction format information from the instruction format information data set document; S305 . Obtain an instruction format matching multi-level dictionary according to the regular expressions of each instruction format information and the name of each instruction format information.

4. The disassembly method for an embedded processor according to claim 1, characterized in that: There are two cases for the disassembly result in step S4033; The first case: the instruction to be tested successfully matches the instruction format information in the instruction format matching multi-level dictionary; The second situation: the instruction to be tested does not successfully match the instruction format information in the instruction format matching multi-level dictionary, and the instruction to be tested is defined as an undefined instruction.

Images